Upgrade Authentik to 2026.2.3

apps/authentik/Chart.yaml

@@ -9,8 +9,8 @@ type: application
 
 dependencies:
   - name: authentik
-    # Match the source Docker deployment for the migration. Upgrade only after
-    # the restored installation has been verified in Kubernetes.
-    version: 2026.2.1
+    # Pin each release explicitly: Authentik database migrations require
+    # sequential, verified upgrades through every release train.
+    version: 2026.2.3
     repository: https://charts.goauthentik.io
     condition: authentikDeployment.enabled

apps/authentik/templates/postgresql.yaml

@@ -78,6 +78,9 @@ spec:
 
   plugins:
     - name: barman-cloud.cloudnative-pg.io
+      # CloudNativePG defaults this to true. Keeping it explicit prevents Argo
+      # CD from reporting harmless drift between Git and the live resource.
+      enabled: true
       isWALArchiver: true
       parameters:
         barmanObjectName: authentik-backups

apps/authentik/values.yaml

@@ -38,6 +38,11 @@ authentik:
       # CA; CloudNativePG rotates its private in-cluster certificates itself.
       - name: AUTHENTIK_POSTGRESQL__SSLMODE
         value: require
+      # Authentik 2026.8 only honors forwarded HTTPS and client-address headers
+      # from explicit trusted proxies. This is the smallest aggregate covering
+      # all current node Pod subnets, so ingress-nginx stays trusted if moved.
+      - name: AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS
+        value: 10.244.0.0/21
 
     # The same Longhorn claim carries three restored source directories. Each
     # subPath is mounted where the upstream container expects it.